Annex B: Risk-based and quality-based approaches
An informative annex that compares a risk-based approach with a quality-based approach and explains how quality models relate to each.
What annex B is
An informative annex that compares a risk-based approach with a quality-based approach and explains how quality models relate to each. It helps a reader connect a risk register to a quality requirement set without treating one as the other.
Annex B is informative. It compares a risk-based and a quality-based approach. An assessor cannot cite it as a requirement.
What the 2023 edition said
The first edition carried the same comparison annex.
What the second edition changes
The annex is kept. No change of substance is recorded in the public draft.
The FDIS text is not public. The change line above is read from the public draft, which is not the FDIS and may differ. No clause level diff is invented here. The ISO stage record is the authority for the dates.
Why it matters to the buyer
Risk and quality answer different questions. Risk asks what could go wrong; quality asks what good looks like. An organisation that uses one as a substitute for the other will have a blind spot. The annex is useful in a board paper because it explains why a quality model is not a risk register and why the organisation needs both.
What to write in the requirement
Keep the risk register and the quality requirement set linked but separate. For each high risk, name the quality characteristic that mitigates it and the measure that shows it works. Review the crosswalk when either document changes, because a risk that is closed in one document can stay open in the other.
Evidence a reviewer asks for
A reviewer will ask whether the quality set was built from the risk register or independently. Both answers are acceptable; an unlinked set is not.
- CrosswalkEach high risk linked to the quality characteristic and the measure that mitigates it
- OwnershipThe owner of the risk and the owner of the quality requirement, named separately
- Review recordThe date the risk register and the quality set were last reconciled
Where it commonly fails
- The quality set is a copy of the risk register
- No link between the two documents
What to do before publication
Add the crosswalk column to the risk register.
Read across
← A Annex A (informative) SQuaRE C Annex C (informative) Performance →
Source for annex B: ISO/IEC 25059, Annex B, retrieved 20 October 2026. The change line rests on the public draft of the second edition and ISO page 88234. The requirement, evidence and gaps are written from our record. Every source.